CVE-2025-24994: Windows 11 Privilege Escalation Flaw

CVE-2025-24994 Overview

CVE-2025-24994 is an improper access control vulnerability [CWE-284] in the Windows Cross Device Service that allows a locally authorized attacker to elevate privileges on affected Windows 11 systems. Microsoft published the advisory on March 11, 2025, covering Windows 11 versions 22H2, 23H2, and 24H2 on both x64 and ARM64 architectures. Successful exploitation grants high impact to confidentiality, integrity, and availability, enabling an attacker with low-privileged local access to gain elevated permissions after user interaction. No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local attacker with low privileges can elevate to higher privileges on affected Windows 11 systems, obtaining full read, write, and execution capability on the host.

Affected Products

Microsoft Windows 11 22H2 (x64 and ARM64)
Microsoft Windows 11 23H2 (x64 and ARM64)
Microsoft Windows 11 24H2 (x64 and ARM64)

Discovery Timeline

2025-03-11 - CVE-2025-24994 published to NVD alongside Microsoft's advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24994

Vulnerability Analysis

The Windows Cross Device Service coordinates continuity features between Windows 11 hosts and linked mobile devices, exposing interfaces that operate under privileged contexts. CVE-2025-24994 stems from improper access control [CWE-284] within this service, allowing an authorized local user to reach functionality intended for higher-privileged principals. The flaw affects Windows 11 22H2, 23H2, and 24H2 across x64 and ARM64 builds.

Exploitation requires local access and user interaction, so an attacker typically combines the flaw with initial-access techniques such as phishing, malicious installers, or already-compromised standard accounts. Once triggered, the attacker executes code in a higher-privileged security context, breaking the boundary between standard and administrative operations.

Root Cause

The root cause is missing or insufficient authorization checks in the Cross Device Service's exposed interfaces. Requests originating from a lower-integrity caller are processed without validating whether the caller holds the required privileges, allowing operations that should be restricted to elevated accounts.

Attack Vector

The attack vector is local. An attacker who already holds an authenticated low-privileged session on the target machine interacts with the Cross Device Service through its client-facing interfaces. The service performs a privileged action on behalf of the attacker, producing an integrity or privilege boundary crossing that yields elevated code execution on the host.

No verified public exploit code is available. See the Microsoft CVE-2025-24994 Update Guide for vendor technical details.

Detection Methods for CVE-2025-24994

Indicators of Compromise

Unexpected child processes spawned by the Windows Cross Device Service (CrossDeviceService.exe) or associated host processes running under SYSTEM or other elevated tokens.
New scheduled tasks, services, or persistence artifacts created shortly after Cross Device Service activity from a standard-user session.
Anomalous inter-process communication between low-integrity user processes and Cross Device Service endpoints.

Detection Strategies

Monitor process lineage where CrossDeviceService.exe or CrossDevice.* binaries launch shells, script interpreters (powershell.exe, cmd.exe, wscript.exe), or LOLBins under elevated tokens.
Baseline normal Cross Device Service behavior on managed endpoints and alert on deviations, including new outbound named-pipe or COM interactions from non-Microsoft callers.
Correlate Windows Security event IDs 4672 (special privileges assigned) and 4688 (process creation) with parent processes tied to the Cross Device Service.

Monitoring Recommendations

Ingest endpoint process, file, and token telemetry into a centralized analytics platform and retain sufficient history to reconstruct privilege-escalation chains.
Track patch state for Windows 11 22H2, 23H2, and 24H2 hosts and flag machines that have not received the March 2025 security updates.
Monitor for standard users performing administrative operations shortly after Cross Device Service interactions, which suggests exploitation of this class of flaw.

How to Mitigate CVE-2025-24994

Immediate Actions Required

Apply the March 2025 Microsoft security updates to all Windows 11 22H2, 23H2, and 24H2 endpoints, prioritizing multi-user and shared workstations.
Restrict local logon rights and remove unnecessary standard-user accounts from systems that do not require Cross Device functionality.
Enforce application control and script execution policies to limit an attacker's ability to stage exploit payloads on endpoints.

Patch Information

Microsoft released fixes as part of the March 2025 Patch Tuesday cycle. Refer to the Microsoft CVE-2025-24994 Update Guide for the specific KB articles corresponding to Windows 11 22H2, 23H2, and 24H2 on x64 and ARM64 builds. Deploy the updates through Windows Update, WSUS, Microsoft Intune, or the update-management tooling standard in your environment.

Workarounds

Where Cross Device features are not required, disable Phone Link and related cross-device pairings through group policy or Settings to reduce exposure of the affected service.
Apply the principle of least privilege by ensuring interactive users operate as standard accounts and reserve administrative accounts for elevation-only workflows.
Segment endpoints that must remain unpatched by limiting network reachability and enforcing stricter endpoint controls until updates are applied.

bash

# Verify Windows 11 build and installed updates on affected hosts
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, OsHardwareAbstractionLayer
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20